Plan and Implement Privileged Access SC-300 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   An administrator needs to configure Microsoft Entra role settings in PIM so that role activations require approval. Which setting should they modify?

   • ARequire multi-factor authentication
   • BAssignment duration
   • CActivation maximum duration
   • DRequire approval to activate
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   Your organization has two break-glass accounts. You need to ensure that the passwords are changed regularly and that the accounts are monitored for usage. What should you do?

   • ADisable the break-glass accounts and enable them only when needed.
   • BAssign the break-glass accounts to a conditional access policy that requires MFA.
   • CUse PIM to manage the break-glass accounts as eligible assignments.
   • DStore the passwords in a secure vault and set up alerts for any sign-in activity.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   When managing Microsoft Entra role assignments in PIM, what is the effect of converting an 'eligible' assignment to an 'active' assignment?

   • AThe user must still activate the role each time they need access
   • BThe user gains permanent access to the role without needing to activate it
   • CThe user is removed from the role
   • DThe user becomes an approver for the role
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of PIM reports, such as the 'Role activations' report?

   • ATo configure approval workflows
   • BTo create new role assignments
   • CTo provide insights into how privileged roles are being used
   • DTo automatically revoke all privileged access
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   Your organization has an Azure subscription that contains several virtual machines and a storage account. You are planning to use PIM for Azure resources. The security team wants to ensure that only the 'Virtual Machine Contributor' role can be activated for the virtual machines, but the storage account should be managed by a separate team. You need to design the PIM configuration to meet this requirement. What should you do?

   • AOnboard the resource group containing the virtual machines to PIM and configure the Virtual Machine Contributor role at the resource group scope.
   • BOnboard the entire subscription to PIM and configure role settings for the Virtual Machine Contributor role at the subscription scope.
   • COnboard the storage account to PIM and configure the Virtual Machine Contributor role at the storage account scope.
   • DOnboard the entire subscription to PIM and configure the Virtual Machine Contributor role at the subscription scope, but exclude the storage account from the role assignment.
   Reveal Solution Discussion Select an answer first